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This article describes the reduction of the operation and fault diagnostics of a DSN 
heat exchanger to a rule base by the application of propositional calculus to a set of logic 
statements. The value of this approach lies in the ease of converting the logic and subse- 
quently implementing it on a computer as an “expert system. ” The rule base was written 
in Process Intelligent Control (PICON) software. 


I. Introduction 

The application of formal systems analysis and propositional 
calculus has great value in the design of an “expert system” 
rule base, where the need is to model knowledge. Propositional 
calculus is a formal logic system from which conclusions are 
deduced independent of the structure of the propositions. The 
conclusions follow uniquely from the truth or falsity of the 
propositions. Once a knowledge base has been converted to 
propositions, assuming it has been done correctly, the process 
of deduction cannot lead to contradictions or to invalid con- 
clusions. One of the consequences is that, given an appropriate 
model, every deduction is a tautology. A description of formal 
systems and propositional calculus can be found in [1] . The 
breadboard heat exchanger expert system is described in [2] . 

The task described in this article involved the conversion of 
the controls and operation of a DSN heat exchanger to a set of 
logic statements for an “expert system” computer operating 
system [2] . The heat exchanger elements and the sensors that 
were converted to logic statements are listed in Table 1. A 
flow diagram (Fig. 1) indicates the position of the sensors in 
the piping. The electrical schematic is shown in Fig. 2. 


The controls and operation were first described in terms of 
hardware for all conditions of service. For example, the heat 
exchanger has dual pumps which are fully redundant. The 
failure of one pump does not affect the capability of the heat 
exchanger to cool the transmitter, except for the reliability 
factor. Two fans are provided, but these are only partially 
redundant. Under certain conditions, both fans are required. 
In addition, a number of other failures can be tolerated pro- 
vided the heat exchanger is operated locally. The Pumps 
Alternating command can be bypassed with a local switch, in 
which case both pumps may be operated simultaneously. All 
of these conditions were described and incorporated in the 
rule base, as the expert system needed the capability to dis- 
tinguish between and not be confused by these alternatives. 


II. Operational Logic Statements 

The word description of the heat exchanger operation was 
then converted to logic statements or schemata. The symbols 
used for the elements are defined in Table 1. The operand 
symbols are defined in the Appendix. 
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For simplicity, the limits in the summations have been omitted, f = (TV - ICl) 2 0< I8KTV (A-l 1) 

but are equal to those of Eq. (A-3). After considerable algebra, 
the functions in Eq. (A-6) reduce to 


(TV - |fi|) cos 

1 . » 1 


sin ( 2 ^) 

2 







Q< l£l<TV (A- 12) 


0 < (A-10) After collecting the terms in Eqs. (A-9)-(A-12) and using 

s Eq. (A-6), the correlation function shown in the main text is 

obtained. 
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The heat exchanger is operational whenever it is providing 
cooling for the transmitter. Coolant must be flowing and heat 
must be removed from the coolant. This implies that at least 
one pump and at least one fan are operating, with the second 
fan available if required for additional heat transfer. The fan 
operation depends on the coolant temperature at the output 
of the core. The two conditions are (a) for a coolant tempera- 
ture <120°F; and (b) for a coolant temperature >1 10°F. 

Let 

a denote condition a is true 
b denote condition b is true 
a denote condition a is false 
b denote condition b is false. 

Given this notation, it can be stated that the heat exchanger 
is operational when 

v V w : a — + xy : b — ► . xy V xy : ab — * . x V y 

The use of dots in the above statement indicates grouping 
as referenced in the appendix. This states that (l)for the heat 
exchanger to be operational, at least one pump (v or w) is on; 
and (2) if the coolant temperature is not less than 120°F, then 
two fans (x and y) are operating, if the coolant temperature is 
not greater than 110°F, then at least one fan is on but not 
both, and if the coolant temperature is between 110°F and 
120°F, then either fan 1 is on or fan 2 is on or both. The 
advantage of schemata can be appreciated when it is desired to 
check the consequences of a statement like the one above. The 
heat exchanger is not operational when the negative of the 
above is made by the use of DeMorgan’s law: 

vwVra.xVy :V:b.xVy .x :y :V abxy 

This states that for the heat exchanger to be not opera- 
tional, both pumps (v and w) are off or the coolant tempera- 
ture is not less than 120°F, and either fan 1 (x) is off or fan 2 
(y) is off; or the coolant temperature is not greater than 1 10°F 
and either fan 1 is off or fan 2 is on, or vice versa; or the 
coolant temperature is between 110°F and 120°F and both 
fans are off. 

In the process of taking the inverse, the “if-then” state- 
ments of the original schema were eliminated and only con- 
junctions and alternations remained. This form is known as the 
“alternative normal form ” Using this form, it is simple to re- 
move inconsistencies. If the schema was found to be valid, 
i.e., true under all conditions of its terms, then this would 
mean that the original schema before inversion was incon- 


sistent. This is a useful check, and errors were found and 
eliminated by this method. Although the above may be logi- 
cally true, from a practical point of view the heat exchanger 
would not be considered not operational if both fans were on 
with a coolant temperature of less than 110°F. In this case, 
the failure does not degrade the cooling capacity of the heat 
exchanger. This is an example of the necessity of analyzing 
each schema and its inverse. It is not always obvious what the 
consequences are, even for rather simple definitions. 

Several assumptions and simplifications were made. It was 
assumed that the heat exchanger is commanded on either from 
the transmitter or from the local panel and that prime power is 
available. It was also assumed that with one pump operating, 
20 gpm of coolant with a pressure differential of 125 psi is 
being supplied. Similarly, it was assumed that the operation of 
the fans moves a quantity of air adequate to maintain the 
coolant exhaust temperature at the transmitter output at less 
than 70°C. Obviously, however, these conditions are not 
always necessarily true; they are also addressed in Section III. 

The heat exchanger is controlled from a three -position 
switch located on a panel on the heat exchanger. In the Local 
position (Cj), power is applied; in the Off position (c Q ), no 
power is applied; and in the Remote position (c r ), power is 
applied if the transmitter control power (pj) is on. With 
respect to the REMOTE/OFF/LOCAL switch S2, and again 
using the notation of the appendix, the heat exchanger is 
operational when 

c r pj V Cj .« >. v V w . x V y 

Associated with the pumps are time delay relays TDR1 and 
TDR2 and pressure switches S4 and S5. When the heat ex- 
changer is turned on, the time delay relays inhibit the pressure 
switches during the time required for the motors to reach 
operating speed. If a pump does not deliver operating coolant 
pressure by the time the time delay relay has timed out, that 
pump will be turned off and the other backup pump will be 
turned on. This provides redundancy in case of a pump fail- 
ure. The time delays of relays TDR1 and TDR2 are designated 
Tj and r 2 , and the functions of pressure switches S4 and S5 are 
designated s 4 and s 5 . 

In addition, there are two alternating relays for the pumps 
and the fans K9 and K14, respectively. To simplify which 
pump and which fan are being turned on at any given time, 
the times are designated tj for pump 1 and fan 1, and t 2 for 
pump 2 and fan 2. After t 2 , the time starts at t x again. 

The hardware conditions for the operation of pump 1 are 
as follows: 

(1) The control circuit breaker (b 6 ) is closed. 
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(2) The main circuit breaker (b 7 ) is closed. 

(3) The pump 1 circuit breaker (bj) is closed. 

(4) The pump 1 contactor (kj) is closed. 

(5) The tank low-level switch (s 3 ) is closed. 

(6) The 480-Vac three-phase power (p 2 ) is available. 

(7) The pump 1 thermal overload (Oj) is closed. 

Similarly, for pump 2: 

(1) The control circuit breaker (b 6 ) is closed. 

(2) The main circuit breaker (b 7 ) is closed. 

(3) The pump 2 circuit breaker (b 2 ) is closed. 

(4) The pump 2 contactor (k 2 ) is closed. 

(5) The tank low-level switch (s 3 ) is closed. 

(6) The 480-Vac three-phase power (p 2 ) is available. 

(7) The pump 2 thermal overload (o 2 ) is closed. 

The control switch is in either the Local or the Remote 
position. If it is in Remote, the 28-Vdc control power (Pj)is 
on from the transmitter and the tank low-pressure cutoff 
switch (Sj) is closed. In addition, either the alternating relay 
is in Pump 1 position (and when pump 1 was turned on, it 
reached a pressure of 60 psig before the pump 1 time delay 
relay closed) or pump 2 was turned on (and the alternating 
relay for pump 2 timed out before the pressure reached 
60 psig or the pressure dropped while pump 2 was operat- 
ing). This can be written in a condensed form using the dot 
notation in the appendix (with multiple dots representing a 
greater break) as follows: 

For pump 1 : 

f l S 4 l . V ' l 2 F 2 V ^ : S V C r S 1 P. • b 6 b 7 P 2 b l k l S 3 °1 

: < * v 

Similarly, with appropriate change of components, pump 2 
operation is: 

r 2 S s *2 vt l F 1 Vi 4 :C l Vc r S l Pi - b 6 b 7 ?2 b 2 k 2 S 3 °2 
> w 

There are conditions when both pumps may be operating 
together. This involves either the use of the critical command 
(c c ) or the closure of the alternating relay disable switch (s 10 ). 
For pump 1 and pump 2 both operating, 


C, v c r », P, . C c V s 10 . b 6 b 7 p 2 b, b 2 k, k 2 s 3 o t o 2 

: « > w v 

The conditions for the fans are similar but not identical to 
those for the pumps. The appropriate circuit breakers, relays, 
overloads, switches, and voltages are required. The difference 
is that the fans are not fully redundant and do not back each 
other up. In addition, the coolant level, the alternating bypass 
switch, and the pressure cutoff switches are not in the fan 
circuit. A temperature switch monitors the coolant, and when 
the coolant temperature is greater than 110°F at the output 
to the coil, the second fan is commanded on. 

The hardware conditions for the operation of fan 1 are: 

(1) The control circuit breaker (b 6 ) is closed. 

(2) The main circuit breaker (b 7 ) is closed. 

(3) The fan 1 circuit breaker (b 3 ) is closed. 

(4) The fan 1 contactor (k 3 ) is closed. 

(5) The 480-Vac three-phase power (p 2 ) is available. 

(6) The fan 1 thermal overload (o 3 ) is closed. 

Similarly, for fan 2: 

(1) The control circuit breaker (b 6 ) is closed. 

(2) The main circuit breaker (b 7 ) is closed. 

(3) The fan 2 circuit breaker (b 4 ) is closed. 

(4) The fan 2 contactor (k 4 ) is closed. 

(5) The 480-Vac three-phase power (p 2 ) is available. 

(6) The fan 2 thermal overload (o 4 ) is closed. 

For fan 1 : 

tj Vt l k lS - C . VC r S l Pi ' b 7 b 3 b 6 P 2 k 3 °3 : * 

For fan 2: 

*1 Vt 2 k 15 - C , VC r S lPl ' b 7 b 4 b 6 ?2 k 4 °4 ' * > X 

For fan 1 and fan 2: 

°3 °4 b 7 b 4 b 3 b 6 P 2 k 3 k 4 k lS ' C . V C r S 1 Pj 1 + * X V 

At this point, schemata have been written to describe the 
operation of the pumps and the fans. These are true when the 
antecedent and the consequent are both true or both false. The 
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schema is false when the antecedent and the consequent are 
not both true or false. Since the operation of the pumps or 
fans is monitored independent of the hardware used for the 
antecedent, a false schema indicates a problem with either the 
sensor or the data collection. If the biconditional is broken 
into two conditionals and each is tested independently, the 
conditionals may provide different information. This is the 
case with the pumps, and this procedure can be used as a 
diagnostic. 

Part of knowing the operational status lies in keeping track 
of the various time durations. How long has the expert system 
been monitoring? How long has the heat exchanger been on? 
How many times has the heat exchanger been turned on and 
off? Other clocks were added as required. Time clock param- 
eters are the following: 

tj = elapsed time since PICON has been on line monitoring 

t r = continuous accumulated time since the heat exchanger 
was turned on 

t t = continuous accumulated time duration since the 
transmitter was turned on 

t c = number of times the heat exchanger has been turned 
on 


III. Heat Exchanger Diagnostics Description 

The next task was to list all components (least replaceable 
units) and failure modes. It was then necessary to identify the 
symptoms and the response of the sensors to each. After de- 
scribing the various possible failures, the propositional logic 
statements were written using the available sensors. For this 
purpose, the phrase “heat exchanger on” was taken to mean 
that one pump and one fan were operating. A sensor was avail- 
able for the coolant flow, but the sensor for the air flow 
proved to be so noisy as to be unusable. The fan rotation sen- 
sor was inoperative due to burned-out lamps. Consequently, 
no direct means of monitoring air flow was available, so the 
fan motor prime power loading was used instead for the rules. 
A sensor for the position of the local control switch S2 was 
not available, although such a sensor would have simplified the 
rules. 

The heat exchanger is required to provide liquid cooling 
for the transmitter. In order to do this, it must deliver at least 
20 gpm with a pressure differential of at least 125 psid. The 
coolant temperature is not to exceed 70°C. The head of the 
transmitter load from the output of the heat exchanger is 
125 ft. Coolant purity is to be maintained with a resistivity of 
not less than 2 megohms per centimeter. These are the most 
critical requirements. Failure to meet these requirements may 


be due either to parts failure in the heat exchanger or to fail- 
ures in the transmitter or prime power; this project was 
limited in scope to the heat exchanger. External failures were 
identified whenever possible, but no procedures were devel- 
oped to isolate such faults. 

The diagnostics began with the heat exchanger off: In the 
Off state, is the heat exchanger available for operation? It is 
not possible to answer this on the basis of sufficient condi- 
tions, but it is possible to conclude some necessary conditions 
for the heat exchanger to be turned on. The “H.E. not avail- 
able” rule defines the conditions that prevent the heat ex- 
changer from being turned on. Fault localization depends on 
sensors. It is always possible that a sensor has failed and the 
equipment is nevertheless operational. Unfortunately, it is not 
easy to isolate sensor failures from equipment failures; only 
through gross sensor error or sensor redundancy can some sen- 
sor failures be isolated. This area has not been thoroughly 
analyzed, and rules have not been developed except for a few 
obvious ones. 

The “H.E. not available” rule was then broken up into 
various rules that identified faults either to a component or, 
if that was not possible, to an area. For example, if a circuit 
breaker has tripped, the possibilities are endless. Reasonable 
and probable considerations must be used in the deductive 
process. The tripped circuit breaker could be the result of 
sabotage, but this is neither reasonable nor probable. The fol- 
lowing basic assumptions were made: 

(1) Wiring has a negligible probability of failure. 

(2) Multiple failures of independent components involv- 
ing the joint probability of two failures occurring 
simultaneously are negligible. 

(3) Problems that cannot be isolated to a component will 

require a technician to troubleshoot the fault with the 
use of test equipment and procedures. 

For the category “H.E. not available,” the choice of sen- 
sors was an adequate compromise. With the sensors available, 
it was not possible to identify the failure of a fuse in the con- 
trol circuit. Sensors should be relocated in the future to iden- 
tify this potential failure. 

The next category is “H.E. available.” In this category, 
warnings are included. In general, if the heat exchanger is 
capable of providing cooling for full power operation with no 
failures, no reporting is desired. If the heat exchanger is capa- 
ble of providing cooling even though failures or potential 
failures exist, then that information is reported. The basic 
schema was deduced as an exclusive-OR of these two condi- 
tions, namely, “H.E. not available” and “no failures.” 
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Some faults are detected only with the heat exchanger on. 
If the heat exchanger is not capable of cooling the transmitter 
as required, the condition is called “H.E. not working.” Note 
that the conditions “H.E. not working” and “H.E. not avail- 
able” differ only in that the heat exchanger must be com- 
manded to operate to detect “H.E. not working” conditions. 
In the “H.E. not available” category are faults which are 
detected whether the heat exchanger is commanded on or off. 

An interlock fault is indicated when a switch sensor located 
in the transmitter indicates a fault. A corresponding analog 
sensor provides the actual value for each interlock. Since these 
are independent of each other, small differences in calibration 
can be expected. The heat exchanger may be operating cor- 
rectly and an interlock fault may indicate a problem in the 
transmitter. 

When an interlock is activated, the transmitter beam power 
is turned off, reducing the heat load immediately and de- 
creasing the coolant temperature drastically. The values of 
flow rate and temperature just before the activation of an 
interlock comprise very useful diagnostic information. 

The failure of the pumps or the fans to cycle properly is an 
indication of equipment failure. Each time the heat exchanger 
is turned off and then turned on, the pumps and fans are alter- 
nately switched. A failure to switch indicates a failure that, if 
not repaired, will lead to a heat exchanger failure. In addition, 
the reliability factor is degraded by the loss of redundancy. 


IV. Diagnostics Logic Statements 

The next step in the task was to convert the diagnostic 
description to maintenance logic that is understood by a com- 
puter. One simplification made was that any fan failure is a 
heat exchanger failure. 

A. “H.E. Not Available’ 1 Rules 

In terms of hardware sensors: 

(1) If both pump thermal overloads (sensors d 6 100 and 
d 6 , 2 oo> are °P en > or 

(2) Ifboth pump circuit breakers (sensors d 3 80 and d 3 100 ) 
are open, or 

(3) If one pump circuit breaker and the other pump ther- 
mal overload are open, or 

(4) If either fan circuit breaker (sensors d 3 200 and d 3 400 ) 
is open, or 

(5) If either fan thermal overload (sensors d 6 400 and 
d 6 , 800 ) is °P en ’ 0f 


(6) If the control circuit breaker (sensor d 3>1 ) is open, or 

(7) If the main circuit breaker (d 3 8000 ) is open, or 

(8) If the phase -sensitive relay (sensor d 3 40 ) is open, or 

(9) If the 120-Vac control power (sensor d 6 8000 ) is not 
present, or 

(10) If low reservoir level switch (d 6 10 ) is open, or 

(11) If low nitrogen pressure switch (d 6 20 ) is open, 

then the sensors indicate that if the heat exchanger were to be 
asked to operate, it would not be available to cool the trans- 
mitter. Indeed, if it did turn on, then the sensors or the data 
link have failed. This is written as: 

d 3,l ^ d 3 ,40 ^ d 6,10 ^ d 6 ,20 ^ d 3 ,80 d 6 ,200 ^ _ 

d 3,100 d 6 , 1 00 ^ d 6 ,800 ^ d 6 ,400 ^ d 3 ,80 d 3,100 ^ d 3,200 ^ 

d 3 ,400 ^ d 6 , 100 d 6 ,200 ^ d 3,8000 ^ d 6,8000 * * S ensors 

indicate that the heat exchanger is not available 

where dj } indicates a normal value from the sensor } and 
d { ■ indicates a fault value from the sensor D-. 

When the rule “H.E. not available” is activated, the follow- 
ing sensor information is useful in localizing faults: 

d 3,80 d 6 ,200 ^ d 3 , 1 00 d 6,100 ^ d 3,80 d 3,100 ^ 

d 6 100 d 6 200 . ► Sensors indicate that both 

pumps are not operational due to either tripped 
circuit breakers or tripped overloads. 

This can be divided further: 

(1) d 3 , 80 d 3 100 d 6 100 d 6 200 * Sensors indicate a 

short in pump 1 . 

(2) d 3 8 0 d 3 100 d 6 100 d 6 200 * Sensors indicate a 

short circuit in primary wiring to pump 1 . 

(3) d 3i80 d 3100 d 6j , 00 d 6> 2 oo * Sensors indicate a 

short in pump 2. 

(4) d 3 80 d 3 100 d 6 100 d 6 200 * Sensors indicate a 

short circuit in primary wiring to pump 2. 

(5) d 6 10 aj j * Low reservoir level sensor indicates 

the heat exchanger is not available. Add coolant and 
check for leaks. (Note that an analog sensor always has 
a value because for a signal of zero a current of 4 mA is 
the output. A sensor failure or data link failure is 
detected by not receiving the 4 mA.) 
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(6) d 6 10 aj j — -*Low reservoir level signal is not 

available. 

(7) ^6 ,20 a i ,2000 * Low nitrogen pressure indicates 

the heat exchanger is not available. Add nitrogen. 

(8) d 6 ,20 a i ,2000 * Low-pressure cutoff switch signal 

is not available. 

The next set of diagnostics involves control power: 

(0 d 3,l * d 6,8000 

(2) d 3>1 Vd 6 8000 . d 3 8000 d 3 40 * Sensors indicate 

a heat exchanger control short circuit. 

( 3 ) d 3,40 V d 6 , 8 ooo d 3,i ► Sensors indicate a heat 

exchanger three-phase power fault. 

( 4 ) d 3,200 d 3,400 d 6 ,400 d 6,soo * Sensors indicate a 

short in fan 1 . 

( 5 ) d 3 ,200 d 3 ,400 d 6 ,400 d 6 ,soo v Sensors indicate a 

short circuit in primary wiring to fan 1 . 

( 6 ) d 3 , 20 o d 3 ,400 d 6,400 d 6,800 > Sensors indicate a 

short in fan 2. 

(7) d 3 , 20 o d 3 ,400 d 6 ,400 d 6,soo * Sensors indicate a 

short circuit in primary wiring to fan 2. 

B. “H.E. Available” Rules 

The heat exchanger may be in need of maintenance and still 
be capable of cooling the transmitter. This condition is called 
“H.E. available.” The following schema can be deduced from 
the “H.E. not available” rule; 

d 3 ,80 d 6 ,200 ^ d 3,100 d 6,100 ^ d 6,100 d 6,200 ^ 
d 3 ,80 d 3 ,100 ^ d 3,100 d 3 ,80 ^ d 6,200 d 6,100 ^ 
d 6,ioo d 3 ,100 ^ d 6,200 d 3 , 8 o * * The heat 

exchanger is available for operation, but mainte- 
nance is to be performed as soon as possible. 

When the “H.E. available” rule is activated, the following 
sensor information is useful in localizing faults. Included in 
this category are the warnings that require attention of mainte- 
nance personnel but still allow operation to continue: 

0) ( a i ,2000 < 30psig)d 6 2O * Add nitrogen to the 

heat exchanger tank. 

(2) a 1(1 d 6>10 ► Add coolant to the tank. Check for 

leaks in the heat exchanger and the transmitter cooling 
pipe assemblies. 

Some faults are detected only with the heat exchanger on. 
If the heat exchanger is on and not capable of cooling the 


transmitter as required, the condition is called “H.E. not work- 
ing.” Note that the condition “H.E. not working” and “H.E. 
not available” differ only by the ON/OFF command. All 
“H.E. not available” conditions are also included in the “H.E. 
not working” category, as these are not mutually exclusive. 
Only conditions that would not be detected with the heat ex- 
changer off are listed below: 

(1) {( a i ,8oo “ a i , 2000 ) ^ 125 psig} + a i ,800 

( 2 ) a i ,20 a i ,800 ( a i ,20 > 2 8P m ) d 6 ,4 * The heat 

exchanger output flow is less than 20 gpm with a pres- 
sure of less than 125 psid as indicated by coolant flow 
sensors. Replace operating main pump. 

(3) d 6,4 d 6,2 d 6 ,i 0 d 6,20 ►Relay K7 defective or 

heat exchanger control switch S2 in the off position. 
The heat exchanger may be operated locally until K7 
is replaced. 

(4) a 2 4 a 2 8 d 6 10 d 6 20 d 6 4 ► Fans are not oper- 

ating properly. Both fans are off. 

( 5 ) a i ,40 a i ,20 • a 2 ,4 ^ 2,8 v a 2,4 a 2,8 * Warning! 

Coolant temperature greater than 110°F and both fans 
are not on. 

(6) d 6>1 a 120 * There is no flow in the purity loop. 

Replace the submicrometer filter (item 34 of the pip- 
ing diagram). 

(7) a 1>4 aj <20 (t r > 10 min) * Replace the purity 

cartridge (item 24 of the piping diagram). 

(8) a t 2 aj >4 a 1?20 (t r > 1 hr) ► Main coolant loop 

is being contaminated. Localize the cause of contami- 
nation. Replace defective component. 

(9) ( a i ,20 ^ 2 gpm) d 31 d 3j8000 d 6 2 d 64 d 6 10 d 3 80 

d 3 , ioo d 6 ,20 d 6 ,100 d 6, 200 d 6, 8000 * Sensors indi- 

cate a heat exchanger control open circuit. 

The transmitter and heat exchanger are usually operated 
with the heat exchanger controlled by the transmitter. It is 
also possible to operate the heat exchanger from local controls. 
This condition is detected only when the transmitter is off and 
the heat exchanger is on. If both systems are on, there is no 
way to tell that the heat exchanger is being operated locally: 

a i ,20 d 6,4 * Heat exchanger under local control. 

An interlock fault is indicated when a switch sensor located 
in the transmitter indicates a fault. A corresponding analog 
sensor provides the actual value for each interlock. Since these 
are independent of each other, small differences in calibration 
can be expected. The heat exchanger may be operating cor- 
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rectly and an interlock fault may indicate a problem in the 
transmitter: 

a i ,20 a 1,800 • ^5 ,1 ^ ^5,2 ^ ^5,4 ^ ^5,8 ^ ^5 ,10 ^ 

d 5 20 V ^ 5 ,40 v ^ 5,80 : * Interlock monitoring 

problem, not a heat exchanger problem. 

The following sensor information is useful in isolating inter- 
lock faults: 

(1) aj 20 a 1800 . d 5 j V d 5 ? V d 5 4 V d 5 8 V d 5 10 V 

dg 20 V d 5 40 Vd 5 , 80 * Sensors indicate the 

cause of the interlock is the heat exchanger. 

(2) d 5)1 Vd 5 )4 Vd 5)10 Vd S)40 ► Flow interlock: 

Magnet flow 

Body flow 

Collector flow 

RF load flow 

(3) d 5>2 V d 5>8 V d S 20 V d 5 >80 * Temperature inter- 

lock: 

Magnet temperature 

Body temperature 

Collector temperature 

RF load temperature 

The values of flow and temperature would be given where 
the dashed lines appear. These values provide valuable informa- 
tion to a maintenance technician. 

A condition for the cycling is that a different pump and a 
different fan be turned on each time the heat exchanger is 
turned on. Turn-on counter t c is incremented each time the 
heat exchanger is turned on. 


Fans cycling : 

0) d 3 ,io d 3,20 ► Fan 1 is on. 

(2) d 3 ,io d 3,20 ► Fan 2 is on. 

(3) d 3,10 d 3,20 Oc) • d 3,10 d 3 ,20 (*c + D : * FanS are 

cycling properly. 

(4) d 3,10 d 3,20 (t c > • d 3 ,10 d 3,20 ( l c + 0 = * FanS are 

cycling properly. 

(5) d 3?10 (t c ) . d 3>10 (t c + 1) :V: d 3>20 (t c ) . d 3}20 (t c + 1) 

.: ► Fans are not cycling properly. 


This is not an exhaustive set of rules. Additional rules should 
be added by maintenance personnel as experience is obtained 
with actual failures and repairs. Ideally, each failure should be 
analyzed and new rules developed to improve the capability of 
the expert system. 


V. Other Diagnostics 

Analysis of heat exchanger efficiency and trends such as 
reservoir level changes can be implemented. This type of infor- 
mation alerts maintenance personnel to possible future prob- 
lems. Preventive or scheduled maintenance can correct a 
potential problem before an actual failure occurs. 

A decreasing reservoir level indicates a leak which, if not 
corrected, will lead to an equipment failure. Actually, detect- 
ing the tank level is somewhat complicated. The reservoir level 
changes when the pumps are turned on due to the expansion 
of the piping caused by the increased pressure at the output of 
the pumps. Another factor is the expansion of metals due to 
temperature. These complications can be taken into account 
in one of two ways: the variation of each measured parameter 
can be found and appropriate corrections made, or the mea- 
surement can be made only at times when conditions are 
identical. For example, the tank level will be measured only 
when the pumps are off and the temperature is within defined 
limits. 


Pumps cycling: 

0) d 3 4 d 3>8 ►Pump 1 is on. 

(2) d 34 d 3>8 ►Pump 2 is on. 

(3) d 3,4 d 3,8 Oc) • d 3,4 d 3,8 (*c + 0 : > Pum P S are 

cycling properly. 

(4) d 3,4 d 3 ,8( t c)- d 3.4 d 3.8( t c) : * Pum PS a « Cy- 

cling properly. 

(5) d 3j4 (t c ) . d 3i4 (t c + 1) : V: d 3>8 (t c ) . d 3)8 (t c + 1) 
.: — -► Pumps are not cycling properly. 


The heat exchanger efficiency was a different problem. 
Deteriorating efficiency indicates future problems. Origi- 
nally, it was intended to calculate the U-factors in the fol- 
lowing manner [3] : 


q = UA AT 

” m 


where 


U = overall heat-transfer coefficient 
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A - surface area for heat transfer consistent with the 
definition of U 

A T m = suitable mean temperature difference across the 
heat exchanger 

However, this method proved to be impractical for a num- 
ber of reasons. Some of the parameters needed are difficult to 
measure (e.g., mass air flow); some of the sensors proved to be 
unreliable; some of the sensors were not available (e.g., sensors 
to measure specific heat of the coolant); and the heat is dissi- 
pated in other places outside the heat exchanger core. (The dis- 
sipation of heat in the long piping lines between the heat ex- 
changer and the transmitter depends on the elements, such as 
rain, snow, ambient temperature, and wind.) Actually, the 
choice of U-factors was a bad one. A better choice would have 
been the Effectiveness-NTU method, defined as 


the coolant temperature at the outlet of the coil and the 
air ambient temperature. The heat exchanger can be calibrated 
and a table of values stored for comparison. Corrections can 
be made for the specific heat of the coolant, air humidity, and 
barometric pressure. Allowing for data errors, a value of the 
efficiency can be used to estimate long-term degradation in 
cooling efficiency. The failure to measure U-factors appears 
to be a case of insufficient investigation of the problem dur- 
ing the design stage. As described above, however, a simple 
alternative exists that could provide the information needed 
by maintenance personnel. 

VI. Conclusions 

Based on the work carried out, the following conclusions 
were made: 


effectiveness = 


actual heat transfer 

maximum possible heat transfer 


This method has the advantage that the inlet and outlet air 
temperature do not have to be measured. The disadvantage of 
this method is the difficulty in obtaining the mass flow rate of 
air across the coil. 


However, the problem can be reduced to a much simpler 
one. The heat taken out of the coolant by the coil can be mea- 
sured without difficulty, and the efficiency of the heat trans- 
ferred is a function of the difference in temperature between 


(1) The use of propositional logic is well suited to the 
development of expert maintenance systems. 

(2) The development of expert maintenance systems must 
involve on-site maintenance personnel. 

(3) The expert system must include not only past exper- 
ience but present and future experience as well. 

(4) The initial effort need not be exhaustive, but rather 
should form a shell that can be expanded with new 
rules and new procedures. In this way it will be easily 
accepted by users and can be developed to reach its 
full potential. 
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Table 1. Heat exchanger sensors and elements 


Sensor number 

Description 

Definition 

Statement 

A-01*0001 

Reservoir level transducer 

>1.5 ft — aj j 


A-01*0002 

Resistivity inlet purity 

>2 megohms/cm 2 -*a 12 


A-01*0004 

Resistivity outlet purity 

>5 megohms/cm 2 -^aj 4 


A-01*0008 

HE core flow 

a l,8 


A-01*0010 

HE bypass flow 

a l,10 


A-0 1*0020 

HE total flow 

>20 gpm - a, 20 


A-01*0040 

HE core outlet temperature 

<112°F -a 1>40 


A-0 1*0080 

HE core inlet temperature 

a 1 ,80 


A-01*0100 

HE assy inlet temperature 

not used 


A-01*0200 

Ambient air temperature 

a l ,200 


A-01*0400 

Core air flow pressure delta 

not usable; too noisy 


A-0 1*0800 

Pump outlet pressure 

oo 

o 

o 


A-01*1000 

Core outlet pressure 

a l,1000 


A-0 1*2000 

Suction inlet pressure 

>15 psig --a, 2000 


A-01*4000 

Pump inlet temperature 

not used 


A-0 1*8000 

Heater outlet temperature 

not part of DSN HE 


A-02*0001 

Pump 1 motor load 

not used 


A-02*0002 

Pump 2 motor load 

not used 


A-02*0004 

Fan #1 motor load 

>1200 watts -> a 2)4 


A-02*0008 

Fan #2 motor load 

>1200 watts -*• a 2 g 


A-02*0010 

Fan #1 speed 

not reliable 


A-02*0020 

Fan #2 speed 

not reliable 


A-02*0040 

A-02*0080 

3-way valve position 
Spare 

not working 


A-02*0100 

HE assy outlet temperature 

a 2,l 00 


A-02*0200 

Heater load 

not part of DSN HE 


A-02*0400 

Differential pressure across 
main line filter 

<15 psid -*■ a 2 400 


D-03*0001 

Auxiliary contacts on CB6 

d 3,l 

b 6 

D-03*0002 

Auxiliary contacts on K5 

not used 


D-03*0004 

Auxiliary contacts on K1 

d 3,4 

k l 

D-02*0008 

Auxiliary contacts on K2 

d 3,8 

k 2 

D-03*0010 

Auxiliary contacts on K3 

d 3,10 

k 3 

D-03*0020 

Auxiliary contacts on K4 

d 3,20 

k 4 

D-03*0040 

Auxiliary contacts on K.6 

d 3,40 

P2 

D-03*0080 

Auxiliary contacts on CB1 

d 3,80 

b l 

D-03*0100 

Auxiliary contacts on CB2 

d 3,100 

b 2 

D-03*0200 

Auxiliary contacts on CB3 

d 3,200 

b 3 

D-03*0400 

Auxiliary contacts on CB4 

d 3,400 

b 4 

D-03*0800 

Auxiliary contacts on CBS 

not used 


D-03*1000 

Auxiliary contacts on K8 

not working on test HE 

c c 

D-03*2000 

Limit SW #1, plenum door 

not used 


D-03*4000 

Limit SW #2, plenum door 

not used 


D-03*8000 

Auxiliary contacts on CB7 

d 3,8000 

b 7 

A-04*0001 

Magnet flow 

>1.5 gpm -*> a 4 j 


A-04*0002 

Magnet temperature 

<70°C -► a 4 2 ’ 


A-04*0004 

Body flow 

>1.2 gpm -*’a 4 2 


A-04*0008 

Body temperature 

<70°C -a 4>4 ’ 


A-04*0010 

Collector flow 

>18 gpm -► a 4 10 


A-04*0020 

Collector temperature 

<70°C -* a 4 2 q 


A-04*0040 

RF load flow 

>6 gpm -^a 4 40 


A-04*0080 

RF load temperature 

<70°C - a 4 g0 


A-04*0100 

Magnet voltage 

not used 


A-04*0200 

Magnet current 

not used 
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Table 1. (contd) 


Sensor number Description 


Definition Statement 


A-04*0400 Spare 

A-04*0800 Body current 

A-04*1000 RF load power 

A-04*2000 Spare 

A-04*40G0 Beam voltage 

A-04*8000 Beam current 


not used 
not used 

not used 
not used 


D-05*0001 
D-05*0002 
D-05*0004 
D-05*0008 
D-05*001 0 
D-05*0020 
D-Q5*0040 
D-05*0080 
D-05*0100 


Low magnet flow interlock d g j 

High magnet temperature interlock d 5 ’ 2 

Low body flow interlock d 54 

High body temperature interlock d 5 g 

Low collector flow interlock ^510 

High collector temperature interlock d 5 2 q 

Low RF load flow interlock d 5 40 

High RF load temperature interlock d 5 gQ 

RF load and RF power range not used 


D-06*0001 

D-06*0002 

D-06*0004 

D-06*0008 

D-06*0010 

D-06*0020 

D-06*0040 

D-06*0080 

D-06*0100 

D-06*0200 

D-06*0400 

D-06*0800 

D-06*1000 

D-06*2000 

D-06M000 

D-06*8000 


Purity loop flow switch 
Auxiliary contacts on K7 
Monitor control power across 
connector pins A and B 
Auxiliary contacts on S8 
Low reservoir level switch 
Low nitrogen pressure switch 
PM1 resistivity meter status 
PM 2 resistivity meter status 
OLl K1 thermal O/L status 
OL2 K2 thermal O/L status 
OL3 K3 thermal O/L status 
OL4 K4 thermal O/L status 
OL5 K5 thermal O/L status 

54 pressure switch status 

55 pressure switch status 
120-Vac control power status 
K15 fan control relay 

S2 panel control switch: 

Remote 

Off 

Local 

TDR1 pump 1 time delay relay 
TDR2 pump 2 time delay relay 
Sjq pump alternating disable switch 
K9 pump alternating relay: 

Pump 1 
Pump 2 

K14 fan alternating relay: 

Fan 1 
Fan 2 



d 6,4 
d 6,8 
d 6,10 
d 6,20 
d 6,40 
d 6,80 
d 6, 1 00 
d 6,200 
d 6,400 

d 6,800 
not used 


not working in test HE 
not working in test HE 

d 6,8000 


Pi 

s 3 


°1 

°2 

°3 

°4 


s 4 

S 5 


r l 

r 2 

s 10 


t 

t 


1 

2 


t 

t 


1 

2 
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Fig. 2. Heat exchanger electrical schematic 
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Appendix 

Logic Symbol Definitions 


The symbols used in the description of the operation of the 
assemblies of the transmitter were taken from [4] . They are 
described below. 

Negation. A bar above a letter represents negation of the 
statement that this letter represents. For example, p means 
“not-p” or -p. The meaning of negation is summed up in “the 
negation of a true statement is false; the negation of a false 
statement is true.” 

Conjunction. The conjunction of two statements such as p and 
q is represented as pq. The meaning of conjunction is taken to 
mean “a conjunction of statements all of which are true is 
true, and a conjunction of statements not all of which are true 
is false.” 

Alternation. The alternation of two statements such as p or q 
is represented as p V q. The meaning of alternation is given by 
this rule: “An alternation is true if at least one of the compo- 
nents is true and otherwise false.” 


Conditional. A statement of the form “if p then q” is repre- 
sented as “p *■ q” and is called a conditional. The “p” 

component is called the antecedent and the “q” component 
is called the consequent. Note that the antecedent is not to be 
interpreted to be the cause of the consequent. If the antece- 
dent is false, the conditional is taken as true regardless of 
whether the consequent is true or false. The relation is “if p 

then q” and “if q then p.” It is represented as “p < *■ q” 

and is called biconditional. 

Grouping. The dot convention is used in place of brackets. 
The insertion of a dot indicates a greater break at the point 
where it is inserted. For example, “pq V r” is understood to 
mean “(pq) V r.” If the intent is “p(q V r) ,” the representa- 
tion is “p.q V r,” indicating the break between “p and q.” 
Greater emphasis is indicated by the use of multiple dots 
such etc. 

Consistency and validity. A schema is called consistent if it 
comes out true under some interpretation of its letters. A 
schema is valid if it is true under every interpretation of its 
letters. 
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